{"record":{"id":"d3a9ebb1eebf0b96","repo":"hashicorp/packer","slug":"signing-mode-q-requires-keyless-identity-and-keyl","errorCode":null,"errorMessage":"signing_mode %q requires keyless_identity and keyless_oidc_issuer unless verifier is explicitly configured","messagePattern":"signing_mode %q requires keyless_identity and keyless_oidc_issuer unless verifier is explicitly configured","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":224,"sourceCode":"\treturn envelope, bundleJSON, nil\n}\n\nfunc (s *keylessSigner) Verifier(ctx context.Context, cfg BackendConfig) (Verifier, error) {\n\treturn newKeylessVerifier(cfg, s.cert)\n}\n\nfunc newKeylessVerifierForEnvelope(cfg BackendConfig, envelope Envelope) (Verifier, error) {\n\tcertificate, err := certificateFromEnvelope(envelope)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn newKeylessVerifier(cfg, certificate)\n}\n\nfunc newKeylessVerifier(cfg BackendConfig, certificate *x509.Certificate) (Verifier, error) {\n\tif strings.TrimSpace(cfg.KeylessIdentity) == \"\" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == \"\" {\n\t\treturn nil, fmt.Errorf(\"signing_mode %q requires keyless_identity and keyless_oidc_issuer unless verifier is explicitly configured\", SigningModeKeyless)\n\t}\n\n\ttrustedMaterial, err := loadKeylessTrustedMaterial(cfg)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"load keyless trusted root: %w\", err)\n\t}\n\n\tsignatureVerifier, err := newSigstoreVerifierFromPublicKey(certificate.PublicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create keyless verifier: %w\", err)\n\t}\n\n\treturn &keylessVerifier{\n\t\tcertificate:       certificate,\n\t\tsignatureVerifier: signatureVerifier,\n\t\ttrustedMaterial:   trustedMaterial,\n\t\tidentity:          cfg.KeylessIdentity,\n\t\toidcIssuer:        cfg.KeylessOIDCIssuer,","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L206-L242","documentation":"newKeylessVerifier refuses to build a keyless verifier when the BackendConfig lacks a non-empty keyless_identity or keyless_oidc_issuer. Verifying keyless signatures requires pinning the expected OIDC identity (SAN in the Fulcio cert) and its issuer; without an explicitly configured verifier these are mandatory. This is a configuration validation error raised before any crypto work.","triggerScenarios":"Calling signer.Verifier(ctx, cfg) on a keylessSigner or newKeylessVerifierForEnvelope(cfg, envelope) with cfg.KeylessIdentity == \"\" or cfg.KeylessOIDCIssuer == \"\" after trimming whitespace (internal/attestation/sign_keyless.go:222-225).","commonSituations":"Verifying a keyless attestation in another environment/pipeline where only the envelope is available and no verifier config was carried over; forgetting to set keyless_identity/keyless_oidc_issuer in the verification backend config; whitespace-only config values.","solutions":["Set both cfg.KeylessIdentity (e.g. the workflow/CI identity like \"https://github.com/org/repo/.github/workflows/x.yml@refs/heads/main\") and cfg.KeylessOIDCIssuer (e.g. \"https://token.actions.githubusercontent.com\") in the BackendConfig used for verification","Carry over the signer's BackendConfig (identity/issuer) into the verification step instead of constructing a fresh empty one","If verification material is available in-process, use the signer-provided Verifier(ctx, cfg) or configure an explicit verifier rather than reconstructing from config","Trim-check the config values are not whitespace-only"],"exampleFix":"// before\ncfg := BackendConfig{SigningMode: SigningModeKeyless}\nv, err := signer.Verifier(ctx, cfg)\n// after\ncfg := BackendConfig{SigningMode: SigningModeKeyless,\n\tKeylessIdentity:   \"https://github.com/org/repo/.github/workflows/release.yml@refs/heads/main\",\n\tKeylessOIDCIssuer: \"https://token.actions.githubusercontent.com\"}\nv, err := signer.Verifier(ctx, cfg)","handlingStrategy":"validation","validationCode":"func validateKeylessVerifyConfig(cfg BackendConfig) error {\n\tif strings.TrimSpace(cfg.KeylessIdentity) == \"\" {\n\t\treturn fmt.Errorf(\"keyless_identity is required for keyless verification\")\n\t}\n\tif strings.TrimSpace(cfg.KeylessOIDCIssuer) == \"\" {\n\t\treturn fmt.Errorf(\"keyless_oidc_issuer is required for keyless verification\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := validateKeylessVerifyConfig(cfg); err != nil { return err }\nv, err := signer.Verifier(ctx, cfg)\nif err != nil { return fmt.Errorf(\"verifier setup failed: %w\", err) }","preventionTips":["Always set keyless_identity and keyless_oidc_issuer wherever keyless attestation verification happens","Propagate the signer's BackendConfig to verification steps","Check values are non-blank, not just present"],"tags":["configuration","sigstore","keyless-verification","oidc"],"backgroundTag":"missing-required-config-field","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}